Fedora Account System
Red Hat Associate
Red Hat Customer
As mentioned in https://pagure.io/releng/failed-composes/issue/1530#comment-661191 , there is a fairly tight dependency loop between selinux-policy (and its subpackages) and rpm-plugin-selinux (a subpackage of rpm): 1. selinux-policy Requires: rpm-plugin-selinux 2. rpm-plugin-selinux Requires: selinux-policy-base, which is a virtual provide that selinux-policy-targeted, selinux-policy-mls and selinux-policy-minimum all provide; in this case, selinux-policy-targeted is providing it 3. All three providers of selinux-policy-base Requires(pre): selinux-policy loops are a problem because, well, obviously, someone's dependency isn't going to be satisfied, and they also result in potentially unpredictable behavior because RPM has to make a more or less arbitrary decision as to how to break them, and that decision can flip based on not-obviously-related circumstances. In this case the loop seems to have contributed to a bug which broke the Rawhide compose today. During live image composes, RPM seems to have previously ordered selinux-policy before selinux-policy-targeted, but today in most live image composes it flipped this ordering; that exposed a bug where selinux-policy-targeted's %post fails if /etc/selinux/config isn't present, even though it's intended to survive this. I've (hopefully) fixed that bug, but the loop is still a problem in general and should be broken if it can be.
There may well be other dependencies that complicate this loop, I haven't had time to investigate that yet.
> 1. selinux-policy Requires: rpm-plugin-selinux I think is simply wrong. rpm itself should do Requires: (rpm-plugin-selinux if selinux-policy), shouldn't it?
> rpm itself should do Requires: (rpm-plugin-selinux if selinux-policy), shouldn't it? Technically that's also "simply wrong" because rpm requires no such thing, rpm will operate merrily regardless of SELinux this or that. Might solve the loop, though.
(In reply to Panu Matilainen from comment #3) > > rpm itself should do Requires: (rpm-plugin-selinux if selinux-policy), shouldn't it? > > Technically that's also "simply wrong" because rpm requires no such thing, > rpm will operate merrily regardless of SELinux this or that. Might solve the > loop, though. Well, since it is conditional... RPM itself will not work *with all necessary basic functionality* if SELinux is enabled.
Another way of solving the loop is using Requires(meta) for rpm-plugin-selinux <-> selinux-policy* dependencies, because unlike those are *not* order-dependent at all, whereas the selinux-policy-foo -> selinux-policy dep is.
This bug appears to have been reported against 'rawhide' during the Fedora 33 development cycle. Changing version to 33.
This message is a reminder that Fedora 33 is nearing its end of life. Fedora will stop maintaining and issuing updates for Fedora 33 on 2021-11-30. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '33'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 33 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete.
AFAICS, nothing has been done about this. The loop still exists as described. None of the changes discussed above have been implemented.
This bug appears to have been reported against 'rawhide' during the Fedora 36 development cycle. Changing version to 36.
I don't think that selinux-policy should require rpm-plugin-selinux, but it was requested and added as a fix for in https://bugzilla.redhat.com/show_bug.cgi?id=1493267 It should be on rpm to fix the loop now.
Oh, I'd forgotten all about this, thanks for the reminder. Technically the dependency *is* two-way: if one installs a selinux-policy, rpm-plugin-selinux must be dragged in for the functionality to work properly, and vice-versa. However this is only a runtime, not install-time dependency, so the ordering loop is neatly solved by flagging the dependency as "meta". Fixed in rpm-4.18.0-0.rc1.2 now, thanks for the reminder. Note that optimally the dependency in selinux-policy would also be flagged as "meta" because it is. This'll get pulled into F37 on the rebase to 4.18 final, doesn't seem worth pulling into F36 at this point.
https://src.fedoraproject.org/rpms/selinux-policy/pull-request/298
(In reply to Panu Matilainen from comment #11) > Oh, I'd forgotten all about this, thanks for the reminder. > > Technically the dependency *is* two-way: if one installs a selinux-policy, > rpm-plugin-selinux must be dragged in for the functionality to work > properly, and vice-versa. However this is only a runtime, not install-time > dependency, so the ordering loop is neatly solved by flagging the dependency > as "meta". > > Fixed in rpm-4.18.0-0.rc1.2 now, thanks for the reminder. Note that > optimally the dependency in selinux-policy would also be flagged as "meta" > because it is. > > This'll get pulled into F37 on the rebase to 4.18 final, doesn't seem worth > pulling into F36 at this point. Panu, The meta keyword is now used in rawhide selinux-policy, thank you for the suggestion.